EDR: Server oversaturated with sensor requests

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Network is oversaturated by sensor requests to the server
• Sensor communications receive 403 responses
• Java datastore process using high amounts of CPU
• datastore/debug.log shows message repeating

[WARN] - from com.carbonblack.cbfs.storage_model_4.SensorRegistrar in qtp853119666-24 
Unknown Sensor(id=0)

 

Environment

• EDR Server: 6.2.3 and Below
• EDR Sensor: All versions

Cause

The server license has been expired for 30 days or more. The sensor is repeatedly sending requests to the server which are being rejected - CB-17129

Resolution

A new server license must be applied

• https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-Update-Cb-Response-Server-license/ta-p/62022
• https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-apply-the-license-via-the-back-end/ta-p/39337

Additional Information

In a cluster, the license must be applied on all nodes of the cluster.